feat(http): count capability denials on the egress gate

[mfw78]

What

nexum_runtime_capability_denials_total, a counter labelled capability, reason and module. capability = "http" is the seam, so the axis scales when the extension seam adds another. reason separates the two refusals: allowlist, where the operator or the manifest did not name the host, and destination, where the address resolved into denied space.

Both emit sites are in crates/nexum-runtime-http/src/http.rs. The allowlist refusal counts in HttpGate::send_request; the address refusal counts at the reject_prohibited_destination call site inside send_with_limits, which now carries the module through. reject_prohibited_destination itself stays a pure predicate.

The destination refusal also gained a warn!, which previously logged nothing at all. It carries the module and the host only, matching the rule the allowlist line already followed about paths and query strings.

docs/production.md gets the metric row, a NexumCapabilityDenied alert, and a line under the policy-refusal table tying HttpRequestDenied and DestinationIpProhibited to the two reasons an operator will see in the counter.

Why

Closes #369

Nothing counted an egress denial, so a guest probing the gate raised nothing an operator could alert on. Folded in from #128, which asked for the operator denylist that landed without the counting.

Cardinality, and where each label comes from

No label carries a value a guest chooses. capability and reason are fixed strings from a Refusal enum. module is the operator-written id from engine.toml. A denied host is exactly the value an attacker controls and is deliberately absent: it appears in the log line, which is bounded, not in a label, which is not. That is the failure #308 was filed for.

reason comes from strum::IntoStaticStr rather than a hand-written match, so a third refusal cannot be added without its label.

What is not counted, deliberately

A transport failure is not a denial. Review found the first revision counted any send_request error as an allowlist refusal; it now counts only ErrorCode::HttpRequestDenied. A DNS failure or a connection reset would otherwise have inflated a security signal with ordinary network noise, which is worse than not counting at all. There is a test for it.

A hostless URI is not a denial either, for the same reason, and also has a test.

The chain read-surface denial is not included. The issue says count every capability denial and the chain gate is one, so this is a scope call rather than an oversight: nexum_runtime_chain_request_total already counts it as method="<denied>" with outcome="err", and #376 just gave those log lines their module. Adding a second counter for the same event would give an operator two numbers for one thing. If the chain gate should move under the shared metric, that is a deliberate consolidation and its own change.

The alert is for: 10m over a [5m] rate, so a single one-off refusal decays out of the window before it fires and only a module that keeps asking raises it.

The capture harness moved, so this does not add a sixth far consumer

The first revision reached capture_metrics through nexum-runtime-testing, which normal-depends on the chain, wasm and world crates. That took cargo nextest run -p nexum-runtime-http from 195 packages to 364, to assert on a counter, using only Sample, capture_metrics, samples_named and block_on_current_thread, none of which need any of it.

The harness now lives in nexum-runtime-metrics behind a testing feature. That crate is a true leaf with exactly one dependency, so any crate can reach it for free, and the capture belongs beside the table it captures. nexum-runtime-testing re-exports it, so no existing consumer changes, and it drops metrics from its own dependencies since the module that used it left.

nexum-runtime-http is back to 214 packages: metrics-util, tokio's rt, and the leaf crate itself.

This is the shape that also answers #364. A harness belongs with the subsystem it observes, which leaves nexum-runtime-testing as the composed mocks that genuinely need the whole engine rather than a bundle where every consumer pays for the heaviest member.

Testing

cargo nextest run -p nexum-runtime-http -p nexum-runtime-metrics -p nexum-runtime-guards -p nexum-runtime --all-features --locked: 117 passed. The guard in nexum-runtime-guards covers the new METRICS entry, so the table row and the emit had to land in one commit.

Four new tests drive real denials through the gate and assert the labels: an_allowlist_denial_is_counted_against_the_module, a_destination_denial_is_counted_against_the_module, a_transport_failure_is_not_counted_as_a_denial, a_hostless_uri_is_not_counted_as_a_denial.

Workspace clippy, rustdoc, doctests, fmt, machete, crate-lints, workspace-deps, zero-leak and content all clean. Cargo.lock gains three lines matching the three manifest additions, no version churn.

AI Assistance

Implementation: claude-opus-5. Red-team review: claude-opus-5. Verification: claude-opus-5. PR description: claude-opus-5.